Security Awareness Microlearning Driven by Agentic AI

Verizon's 2026 Data Breach Investigations Report puts the human element in 62% of breaches, as reported by Help Net Security. For the security awareness manager or SOC lead who owns what happens next, the follow-up is often a person copying names into a spreadsheet and sending reminders by hand. This post shows those teams how security awareness automation is built so it holds up in front of an auditor.

‍

In short: Security awareness automation works when every rule names a trigger, an audience and an action, sends high-stakes actions to an analyst for approval, can be tested before it goes live, and leaves a log.

‍

Security Awareness Automation Starts With Rules

A rule is a plain sentence: when this event happens to these people, do this. A reminder, a policy re-attestation and a training assignment can all be written that way, which makes human risk automation rules easier to review than a long list of campaigns. Chained together, they become automated security awareness workflows that a department head can read in a minute.

‍

The signal behind a rule is rarely a surprise. The report's executive summary lists phishing as the way in for 16% of breaches, unchanged from the year before, behind vulnerability exploitation at 31% and ahead of credential abuse at 13%. Those figures describe the attacker's side. A rule describes your response, and the response is where most programs lose days.

‍

‍

Fraus builds that response as automation rules. The sections below follow the order in which a rule is written, run and trusted.

‍

Triggers, Audiences and Actions

Triggers. Rules start from events in seven categories: simulation results, identity, endpoint, data loss prevention, directory, training and risk score events. The mix matters. A simulation result shows how someone behaved in a test, an identity or endpoint event shows what happened on a real system, and a risk score event shows that the overall picture has changed. How simulations themselves run is covered in automated phishing simulation.

‍

Audiences. An audience is built from presets, departments, directory groups and named people. Pointing a rule at a directory group means it can follow a group you already maintain, instead of a list someone has to remember to update.

‍

Actions. One rule can assign nudges, modules, videos, policies or posters, and notify role groups or the employee's manager. Keep each rule narrow. A rule that sends one nudge to one department after one kind of event is easy to explain and easy to switch off. For the moment a person shows risk, just-in-time coaching in Microsoft Teams covers the immediate response, and rules cover the policy around it.

‍

Approval Gates, Chaining and Schedules

Some actions should never fire alone. In Fraus, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval. That gate is what lets a security team accept automation for the routine work, because the consequential work still passes a person.

‍

Chaining and escalation. A rule can chain into another and escalate when an action goes unacknowledged. A nudge that is ignored can become a note to the employee's manager. Write the escalation path before launch, and make sure it ends with a named owner rather than a shared inbox.

‍

Scheduled rules. Not every rule waits for an event. Weekly, monthly, quarterly and annual schedules cover executive reports, policy re-attestation and risk score recalculation. These are the duties a calendar reminder used to carry, and they are the ones that slip in the month an audit arrives.

‍

Recommend, Test, Then Trust

Writing rules from a blank page stalls programs. Odin proposes ready-to-apply rules, each with an estimated 30-day match count and its reasoning. The match count tells you how busy a rule would have been, which is the first thing an approver asks.

‍

Before anything goes live, run the rule through test before you trust. It simulates an event and shows what would happen, so you read the outcome before an employee does. Test with the audience that would be most embarrassed by a wrong message, usually executives or finance, and check the rule against this list.

‍

• The trigger names one event and one condition.
• The audience is a group someone owns.
• Any action touching access or payments goes to an analyst.
• The escalation path ends with a named person.
• The test event produced the result you expected.

‍

When No Rule Covers the Event

Rules cover what you foresaw. For events no rule covers, agentic AI writes a contextual rule and acts, in one of three modes. Off keeps it from acting. Supervised sends each proposed action to approvers, who confirm by email. Unsupervised lets it act on its own, but only after a 30-day trial in which it still asks first.

‍

Admin rules take priority over anything the agentic AI writes. Every rule is labeled by origin, so you can tell an analyst's rule from an AI-written one, and every agentic action is logged for audit. That record answers the question a CISO or auditor will ask sooner or later: who decided this, and when.

‍

Start With Three Rules

Go back to the spreadsheet from the start. Pick the three follow-ups your team repeats most, write each as a trigger, an audience and an action, and test them. Keep the agentic AI in Supervised mode until the audit log has earned a case for more. Then see how the pieces fit together on the agentic automation rules page.

‍

Frequently Asked Questions

What is security awareness automation?

‍

It is the practice of letting rules run the follow-up work in a security awareness program. An event, such as a simulation result or a risk score change, triggers an action for a defined audience, such as a nudge, a module or a manager notification, without anyone sending it by hand.

‍

What should a security awareness automation rule include?

‍

Every rule needs a trigger, an audience and an action. Add an approval gate for anything that touches access or payments, an escalation step for actions nobody acknowledges, and a test before it goes live. Label the rule by origin so the audit log shows who or what created it.

‍

Which actions should wait for an analyst?

‍

In Fraus, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval. Use the same test for your own rules: if a wrong action would block someone's access or delay a payment, a person should confirm it first.

‍

What do Off, Supervised and Unsupervised mean?

‍

They are the modes for agentic AI when no rule covers an event. Off means it does not act. Supervised means approvers confirm its proposed actions by email. Unsupervised means it acts on its own after a 30-day trial in which it still asks first. Every action is logged for audit.

A phishing campaign comes with a calendar. Someone picks a theme, builds the template, chooses the audience, launches, waits, pulls the report, briefs management and starts again next quarter. For a security awareness manager on a lean team, that cycle is the program, and it quietly decides how often anyone is tested. This post is for the people who run that cycle and want to see what autonomous phishing simulation looks like once it is gone.

‍

In short: Autonomous phishing simulation replaces the campaign cycle with agentic AI that picks each person's next simulation, difficulty, trigger and timing. You set guardrails once, and your team acts only when the system asks.

‍

Why Campaigns Cap Your Program

A campaign treats the workforce as one audience. Everyone gets the same lure at the same moment, so the result describes the template as much as the people. NIST built its Phish Scale with this in mind. It rates a phishing email's content across five elements to give a difficulty of low, medium or high, so a click rate can be read against how hard the lure was to detect. NIST describes the method in its own words.

‍

Most breaches run through people. Verizon's 2026 Data Breach Investigations Report found that human involvement contributed to 62% of breaches in 2025. Against that, a quarterly campaign leaves up to three months with no fresh signal on any individual.

‍

‍

That is the gap a campaign calendar leaves open. Closing it with more campaigns means more planning, more launches and more reviews, which is exactly what a small team cannot add.

‍

What Autonomous Phishing Simulation Means

Autonomous phishing simulation is a program where the system, not an administrator, decides what each person receives and when. Continuous phishing simulation is the visible result: simulations reach each person at their own pace all year instead of in waves. You will also see it called campaignless phishing or phishing without campaigns, and both phrases describe what disappears: the campaign itself, with its audience list, launch date and end date.

‍

Agentic AI phishing simulation is how that works in practice: an agent looks at the individual and chooses the next step. The wider question of what automation should run and what a team keeps is covered in Automated Phishing Simulation: What Runs, What You Keep. This post stays on the model where the campaign is removed.

‍

How Graybait Runs Without Campaigns

Graybait is the Fraus phishing program built on this model. Setup is four steps, then it runs for twelve months with minimal administrative effort:

‍

1. Connect the workforce.
2. Set guardrails.
3. Choose an objective.
4. Activate.

‍

From there the agentic AI picks or generates each employee's next simulation from their Human Risk Profile. It sets the difficulty, theme, psychological trigger and timing for that person. Lures match the person's role, context and history, so someone in finance and someone in facilities need not receive the same message.

‍

Difficulty moves with the individual. It rises as a person keeps spotting attacks, and a method is retired once that person has beaten it. Frequency follows each person's risk, within the limits an admin sets. A colleague who keeps spotting lures is not pulled into the same routine as one who struggles.

‍

What Happens When the System Asks

After activation, the team steps in only when the system asks. The work shifts from producing simulations to responding to requests, and the new way to stall is a request that nobody owns. Name one person who answers, and a backup, before you activate.

‍

The same principle runs through other Fraus agentic work. In Agentic Automation Rules, higher-stakes actions such as step-up MFA or a finance approval hold always wait for analyst approval, and every agentic action is logged for audit. Asking first is part of the design.

‍

Then comes the long middle. The program runs for twelve months after the four setup steps, with no launch dates inside it.

‍

Inside that year, one person is moving to harder lures because they keep spotting attacks. Another has beaten a method, so it is retired for them. A third is tested more often because their risk is higher. Your calendar shows none of this, which is why reporting needs a different shape.

‍

Reporting With No Campaign Report

Management is used to a report at the end of each campaign. With none, you report what Graybait tracks for each person and across the workforce:

‍

• Individual susceptibility over time. A trend for each person instead of one rate per wave, so you can say whether people are getting harder to fool rather than how a single template performed.
• Weakness coverage. How far the program has reached into each person's weak spots, which answers what has not been tested yet.
• Difficulty progression. How the difficulty has risen as people keep spotting attacks, which shows leadership that the program is not stalling at an easy level.

‍

Risk also needs a home outside the simulation. Odin scores each employee's risk continuously and weights it by role criticality, which helps you read these views next to the rest of the picture.

‍

Leaving the Campaign Calendar

Go back to the calendar from the start. Switching means stopping a few habits: building templates, setting launch dates and writing an end-of-campaign report. The slot you held in the management meeting stays, and the three views above fill it.

‍

Staff and managers need a short heads-up. Simulations now reach each person on their own schedule through the year, so colleagues are less likely to compare notes about the phishing test going round this week. Managers should expect to be asked for context when a pattern needs a conversation.

‍

Your next step is to pick who answers the system and which management meeting will receive the first reporting views. Then see how Graybait handles the rest.

‍

Frequently Asked Questions

What is autonomous phishing simulation?

‍

It is a phishing simulation program where agentic AI, not an administrator, decides what each person receives, how hard it is and when it arrives. There are no campaigns to plan, launch or review. The team sets limits and an objective at the start, then responds when the system asks for input.

‍

Does phishing without campaigns mean losing control?

‍

No. You set the guardrails and choose the objective before activation, and frequency follows each person's risk within the limits an admin sets. What you give up is the manual work of building and launching each wave, not the authority over what the program may do.

‍

How is this different from automated phishing simulation?

‍

Automation can mean a scheduler that still sends campaigns on a timer. The campaignless model removes the campaign, so each person gets a simulation chosen for them. The published guide on automated phishing simulation explains what automation should run and what a team keeps.

‍

How does Graybait get started?

‍

Setup is four steps: connect the workforce, set guardrails, choose an objective and activate. It then runs for twelve months, and the team steps in only when the system asks. Talk to Fraus about your environment and objectives before choosing guardrails.

Open the Arabic version of a training module and read the first screen aloud. If it sounds like English written in Arabic letters, your employees have already noticed. This post is for security awareness managers in the UAE and wider GCC who are comparing Arabic security awareness training and need a way to tell authored content from translation.

‍

In short: Arabic security awareness training works when the Arabic was written for the situation, not converted after the English was finished. Check the scenarios, tone, layout and simulations, and keep one risk record per employee across both languages.

‍

Why Arabic Security Awareness Training Matters

Arabic is the official language of the UAE, and the UAE government fact sheet names five other official languages for court proceedings: Chinese, English, French, Hindi and Russian. It adds that Bengali, Farsi, Malayalam, Turkish and Urdu are also widely spoken. A single office in Dubai or Abu Dhabi can hold all of these on one floor.

‍

The wider Gulf looks similar. National statistics compiled by the Gulf Labour Markets, Migration, and Population Programme show non-nationals making up 67.9% of Kuwait's population and 53.4% of Bahrain's in 2024, and 44.4% in Saudi Arabia. Population is not workforce, and it says nothing about who reads which language, but it explains why a program in one language leaves part of the staff learning in their second.

‍

‍

Government programs reflect this. The Telecommunications and Digital Government Regulatory Authority offers its information security awareness sessions to government employees in Arabic and English. Offering both is the baseline. The harder question is whether the Arabic is any good.

‍

Telling Authored Arabic From Translation

A translated course tends to give itself away in small ways: stiff phrasing, scenarios that only make sense in another country, buttons that point the wrong direction. Ask the vendor for the full Arabic scripts and give them to a native reader in your own team. Then run through this list.

‍

• Scenarios. The situations belong to your region: a payroll notice, a courier delivery, a supplier changing bank details, not a scenario about a service your staff have never used.
• Register. The text sounds like a colleague at work, with no word-for-word English sentence structure showing through.
• Direction. Right-to-left holds across quiz answers, progress bars, email previews and certificates, including links and numbers placed inside Arabic sentences.
• Terms. Each security term has one Arabic rendering, used throughout, and the English term appears where staff meet it in their own tools.
• Parity. The Arabic course has the same modules, depth and update dates as the English one, not a shorter subset.

‍

A course that passes these checks was edited by someone who reads Arabic for a living. One that fails two or three was probably converted at the end of the project, and your staff will treat it as a formality. Content is only half the program, though, because the test of what people learned is the simulation.

‍

Arabic Phishing Training Needs Native Lures

Arabic phishing training has two parts, the lessons and the simulated attacks, and both must be in the language the employee reads. If someone trains in Arabic but only ever receives English test emails, you are measuring a skill the training never covered. The reverse has the same flaw.

‍

Check that the simulation library has Arabic templates written as lures, with the pressure, urgency and wording a real message in Arabic would carry. Whitebait runs phishing simulation for UAE and GCC organizations with Arabic and English templates, and tracks the reporting rate next to the click rate, so you can see whether Arabic readers report as readily as English readers.

‍

When someone does fall for a lure, the lesson should arrive in their language, matched to what they just did. Codex delivers security awareness training in Arabic and English as agentic AI-driven micro-learning: short lessons that Fraus's agentic AI recommends or assigns to each person from their training gaps and behavioral signals. Just-in-time coaching inside Microsoft Teams closes the gap between the mistake and the lesson.

‍

Running Bilingual Security Awareness Training

Bilingual security awareness training often breaks down in the reporting rather than the content. If Arabic and English learners sit in separate spreadsheets, nobody can compare them. Ask a hard question of every platform: does one employee keep one record, whichever language they train in?

‍

That one record is what makes English Arabic cybersecurity training measurable. Odin keeps continuous per-employee risk scores and individual threat profiles, so an employee who reads Arabic and English moves through the same profile whichever language a lesson arrives in. Split your reports by language at least once a quarter to find where the gap is.

‍

If you are still building the shortlist, the UAE buyer's checklist covers the wider criteria, and the phishing simulation guide covers what to check before you buy simulation. This post covers the language layer on top of both.

‍

Test the Arabic Before You Sign

Back to the first screen. Before you commit to a platform, ask for a pilot where two native Arabic readers from different departments, such as finance and operations, review three modules and one simulation. Have them mark every sentence that sounds translated and every scenario they would not recognize.

‍

Their notes will tell you more than a feature list. If they mark a handful of lines, fix them and go ahead. If they mark pages, you have learned that cheaply, before the rollout.

‍

Frequently Asked Questions

How do I check whether a platform really supports Arabic?

‍

Request the full Arabic scripts for lessons and the simulation templates, not a screenshot. Have a native reader and a non-specialist employee review them for tone, local scenarios and right-to-left layout. Ask whether new content arrives in Arabic and English on the same date.

‍

Are phishing simulations available in Arabic as well as courses?

‍

They should be, and you should confirm it before buying. Some programs translate the courses and leave the simulations in English, which tests a different skill. Whitebait provides Arabic and English templates for UAE and GCC organizations, with reporting rate tracked next to click rate.

‍

Can the same employee receive content in Arabic and English?

‍

A bilingual program should let each person work in the language they read best. Codex delivers training in Arabic and English, and Odin keeps one risk profile per employee, so lessons in either language feed the same record.

‍

Do UAE authorities treat Arabic and English as standard for awareness?

‍

The UAE Telecommunications and Digital Government Regulatory Authority runs its awareness sessions for government employees in Arabic and English. That is a useful reference point when you set the language standard for your own program.